22ff4b883468f0b2b21b2c50d5ca5bd9[.]bin

General

Target

22ff4b883468f0b2b21b2c50d5ca5bd9.bin
Size

28KB
MD5

90255ae1646ecba250ab9ca42a4edc48
SHA1

bddeef1b3cfbe118e6add46891a8cc7ca751f31f
SHA256

b07f583e8617d0e4faa3982b5613cda10db48a28c4d9909bae93ccafec153e74
SHA512

0a810e6ed2b9b6af8cd78142591f58f7b0d1dae13b33f50bd3706f660aa150d28c1d22fe1e43e5e248a1366285fe853f6c787e963aea3e0cc2b392f5609e5a3c
SSDEEP

768:bjTayKkchH+P4260n3+5j7LitHzGS/YtMzM8v:P2jheDnuJitHbU8v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe

Files

22ff4b883468f0b2b21b2c50d5ca5bd9.bin
.zip

Password: infected
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
.exe windows:5 windows x86 arch:x86

Password: infected

ba2ce247fa49357770ce28f139e2f1ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointerEx
CloseHandle
lstrlenW
CreateFileW
HeapCreate
GetCurrentProcess
ExitProcess
CreateThread
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
Sleep
GetLogicalDrives
SetFilePointer
FindClose
lstrcmpiA
lstrcmpiW
lstrcpyA
ReadFile
lstrcatW
GetModuleFileNameW
CreateProcessW
GetEnvironmentVariableW
GetDriveTypeA
GetTempPathW
GetTempFileNameW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
SetPriorityClass
MultiByteToWideChar
WideCharToMultiByte
CompareStringA
WriteFile
GetFileSizeEx
GetLastError
lstrlenA
GetProcessHeap
HeapFree
HeapReAlloc
lstrcpyW
HeapAlloc

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW

shell32

SHChangeNotify
ShellExecuteExW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

ntdll

_aulldiv
_alldiv
_allrem
_chkstk
RtlUnwind
NtQueryVirtualMemory

Sections

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

ba2ce247fa49357770ce28f139e2f1ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

ntdll

Sections

.rdata Size: 52KB - Virtual size: 51KB

.rdata
Size: 52KB - Virtual size: 51KB